topic Re: ISE: No more logs after having replaced PSN in Network Access Control

ISE: No more logs after having replaced PSN

jds5 — Mon, 12 Dec 2022 10:53:16 GMT

Hello,

Following the reset of the /opt partition which was full (100%) on MNT, we no longer have Splunk logs on 2 new PSN 3695

while the other 4 PSN(3595) continue to work correctly.

There are collection log Errors:

The ISE MNT collector process is unable to persist the audit logs generated from the Policy Service nodes.

The current version is: 2.7.0.356 P5

BR,

jds5 — Mon, 12 Dec 2022 11:00:56 GMT

I found this bug CSCvv08466 which seems to correspond but it's already fixed in patch 3

Mark Elsen — Mon, 12 Dec 2022 11:02:47 GMT

jds5 — Mon, 12 Dec 2022 13:37:26 GMT

Thanks for this feedback.

Another point which must also be taken into account:

We could not reimport the ISE Messaging Service certificate on the new equipments.

Can this have an impact on the logs knowing that the option [Use "ISE Messaging Service" for UDP Syslogs delivery to MnT ] is disabled?

jds5 — Mon, 12 Dec 2022 13:40:32 GMT

this could not be done because on the new PSN, the ISE Messaging Service certificate used has a different domain name

Charlie Moreton — Mon, 12 Dec 2022 13:50:47 GMT

Navigate to Administration > System > Logging. You should see that Use ISE Messaging Service for UDP Syslogs delivery to MnT is enabled. This is a new feature that was released in ISE 2.6 and I have run in to this issue. You may need to regenerate these certificates after an upgrade.
To fix this you need to generate new deployment-wide signed certificates. This is a simple process that can be done by navigating to Administration > System > Certificates and choosing Certificate Signing Requests from the left menu
Click the button for Generate Certificate Signing Requests (CSR)

In the Usage field, select that the Certificate(s) will be used for ISE Messaging Service

Since this is an upgrade, ISE Messaging may not have been enabled previously, you need to select Generate CSR for ISE Messaging Service
Select ALL the ISE Nodes and fill out the certificate fields

Of course, you should follow any guidance and troubleshooting from the Cisco Identity Services Engine Upgrade Guide, Release 2.7